New User to Alta Labs environment with questions about IDS/IPS

General
,
1

Hello!

Happy Halloween!!!

I am a new user to the Alta Labs environment and had some general questions after I received an IDS notification for the first time on this environment and went to dig deeper, however had some struggles to see more information about the notification. I am not sure if the features are lacking or if not properly educated in the admin panel:

  1. Is there a CLI or SSH access on the Route10?
  2. Where can I see the full alert (queried domain, SID, action)?
  3. Can I raise the syslog size limit or forward full eve.json events?
  4. How do I view and clear IPS blocks? Do they expire?
  5. Is it expected that inline mode blocks all host-to-gateway traffic instead of just the matching flow?
  6. Can I suppress this rule or exclude one client IP?
  7. Can I set rules or categories to alert-only while keeping inline for the rest?

Any help answering the questions above will be greatly appreciated, Thank you!